On this week’s show, Patrick Gray and James Wilson are joined by special guest The Grugq. They discuss the week’s cybersecurity news, including:

• Vercel got owned, and there’s a few infostealer and compromised employee dots to connect
• Mozilla used Mythos to find 271 bugs, which feels like a sign of the bug-pocalypse
• Speaking of the bug-pocalypse, is that why NIST is noping out of enriching a bunch of bugs?
• The NSA is using Mythos even though the government did that whole Anthropic blacklisting thing
• And DDos attacks hit a couple of smaller-player socials

This week’s episode is sponsored by Permiso. Ian Ahl chats to Pat about the subtle signals Permiso uses to detect ShinyHunters-style activity in cloud and on-prem environments.

This episode is also available on Youtube.

Show notes

• Vercel April 2026 Security incident
• Vercel breach linked to infostealer infection at Context.ai
• Vercel confirms breach as hackers claim to be selling stolen data
• Matt Johansen: “This is not a good look” | X
• NIST limits vulnerability analysis as CVE backlog swells | Cybersecurity Dive
• CISA Cyber on X
• Ransomware attack continues to disrupt healthcare in London nearly two years later | The Record from Recorded Future News
• Lawmakers ponder terrorism designations, homicide charges over hospital ransomware attacks | CyberScoop
• In defeat for Trump, House extends electronic spying program for just 10 days | The Record from Recorded Future News
• Crypto infrastructure company blames $290 million theft on North Korean hackers | The Record from Recorded Future News
• US-sanctioned currency exchange says $15 million heist done by "unfriendly states" - Ars Technica
• Hackers are abusing unpatched Windows security flaws to hack into organizations | TechCrunch
• Mozilla Used Anthropic’s Mythos to Find and Fix 271 Bugs in Firefox | WIRED
• NSA using Anthropic's Mythos despite Defense Department blacklist
• Beyond the breach: inside a cargo theft actor’s post-compromise playbook | Proofpoint US
• Beware scam messages offering ships safe transit through Hormuz Strait, says security firm | The Straits Times
• New Jersey men given lengthy sentences for running North Korean laptop farms | The Record from Recorded Future News
• Turns Out We’re Not Alone - Volodymyr Styran
• US joins nearly two dozen other countries in striking back against DDoS-for-hire platforms | Cybersecurity Dive
• Bluesky blames app outage on ‘sophisticated’ DDoS attack | The Record from Recorded Future News
• Mastodon says its flagship server was hit by a DDoS attack | TechCrunch
• An IT expert explained under what conditions using a VPN can cause a smartphone to explode